Jim Becher

An authenticated, read-only user can upload a file and perform a directory traversal to place the uploaded file in a location of their choosing. This can be used to overwrite existing PERL modules within the application, potentially leading to remote code execution (RCE) by an attacker.

An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized export of the appliance configuration, potentially exposing sensitive information.

An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized access to appliance configuration import functionality, potentially enabling an attacker to gain administrative privileges. The vulnerable `API endpoint` allows control over the appliance configuration.

An authenticated, read-only user can terminate any processes running on the virtual appliance as the `lpar2rrd` user.

An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized download of appliance configuration logs, potentially exposing sensitive information.

The NagVis component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.

The issue concerns the "NagVis" component within Checkmk, which is susceptible to remote code execution. An authenticated attacker with administrative level privileges can upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.

The issue allows services running and bound to the loopback interface on the Artica Proxy to be accessible through the proxy service. Specifically, the `tailon` service, which runs as the root user and listens on TCP port 7050, can be used to view the contents of any file on the Artica Proxy. Security issues related to exposing this network service are documented on gvalkov's `tailon` GitHub repository.

The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user.

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker to elevate privileges to root on an affected device. This issue is due to insufficient input validation of user-supplied CLI arguments. An attacker could exploit this by authenticating to the device and using crafted commands at the prompt, potentially allowing the execution of arbitrary commands as root. The attacker must have valid credentials on the affected device.

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker to elevate privileges on an affected device. This issue is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing certain commands using `sudo`. A successful exploit could allow the attacker to view arbitrary files as `root` on the underlying operating system. The attacker must have valid credentials on the affected device.

An issue was discovered that involves Unauthenticated API Endpoints.

An issue was discovered that allows Directory Traversal through the API.

An issue in the Web Application of the CommScope Ruckus IoT Controller allows authenticated users to perform arbitrary read/write actions. The API endpoint allows an HTTP POST request to write arbitrary content into any file on the filesystem with root privileges.

An issue was discovered that involves hard-coded system passwords, which provide shell access.

An issue was discovered where hard-coded web application administrator passwords exist for the `admin` and `nplus1user` accounts.

An issue was discovered where hard-coded API keys exist.

An issue exists in the CommScope Ruckus IoT Controller, where an undocumented backdoor allows shell access via a developer account. This backdoor enables unauthorized access, potentially leading to further exploitation.

🚨 CVE-2020-28334 Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28331 could potentially be used in a simple and automated exploit chain to go from unauthenticated remote attacker to root shell. 🎖@cveNotify

The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions, instead using a `SEID` token appended to URLs in GET requests. This `SEID` token can be exposed in web proxy logs and browser history. An attacker who captures the `SEID` and originates requests from the same IP address can access the device's user interface without knowing the credentials.